GHSA-87v3-4cfp-cm76

## Summary The SVG schema plugin in `@pdfme/schemas` renders user-supplied SVG content using `container.innerHTML = value` without any sanitization, enabling arbitrary JavaScript execution in the user's browser. ## Details In `packages/schemas/src/graphics/svg.ts`, line 87, the SVG schema's `ui` renderer assigns raw SVG markup directly to `innerHTML` when in viewer mode or form mode with `readOnly: true`: ```typescript // svg.ts, line 81-94 (non-editable rendering path) } else { if (!value) return; if (!isValidSVG(value)) { rootElement.appendChild(createErrorElm()); return; } container.innerHTML = value; // <-- VULNERABLE: unsanitized SVG injected into DOM const svgElement = container.childNodes[0]; if (svgElement instanceof SVGElement) { svgElement.setAttribute('width', '100%'); svgElement.setAttribute('height', '100%'); rootElement.appendChild(container); } } ``` The `isValidSVG()` function (lines 11-37) only validates that the string contains `<svg` and `</svg>` tags and passes `DOMParser` well-formedness checks. It does NOT strip or block: - `<script>` tags embedded in SVG - Event handler attributes (`onload`, `onerror`, `onclick`, etc.) - `<foreignObject>` elements containing HTML with event handlers - `<animate>` / `<set>` elements with `onbegin` / `onend` handlers - SVG `<use>` elements referencing malicious external resources All of these are valid SVG and pass `isValidSVG()`, but execute JavaScript when inserted via `innerHTML`. ## Attack Vectors ### 1. Malicious Template (readOnly SVG schema) An attacker crafts a template JSON with a readOnly SVG schema containing a malicious `content` value. When loaded into the pdfme Form or Viewer component, the SVG executes JavaScript. ### 2. Application-Supplied Inputs + Viewer If an application uses the pdfme Viewer component and passes user-controlled data as inputs for a non-readOnly SVG schema, the attacker's SVG flows directly to `innerHTML`. ## Proof of Concept Loadi